Global – October 31, 2026 -- CrowdStrike has added Third-Party IOC Management to Falcon Next-Gen SIEM, letting security teams ingest, curate and manage externally sourced threat indicators in the same platform that holds their security telemetry.
The feature targets a "bring your own intelligence" model. Indicators from commercial providers, ISACs, government sources, open-source research, partners and internal incident response often sit in spreadsheets, ticketing tools and separate threat intelligence platforms. CrowdStrike says manual imports across those tools add operational overhead, delay detection, generate unnecessary alerts and slow investigations.
Ingestion covers IPs, domains, URLs and file hashes via STIX/TAXII, APIs and uploads
Teams can onboard IOCs through STIX/TAXII, APIs or direct uploads. The platform automatically consolidates duplicate indicators across sources.
Curated indicator lists feed correlation rules and threat hunting
Indicator lists update automatically and can be used in correlation rules and hunting searches against security telemetry, removing the need to maintain separate lists.
Expiration settings target false positives from stale IOCs
Lifecycle controls let teams expire outdated indicators, which CrowdStrike says cuts manual maintenance and alert noise. Third-party and proprietary indicators also run alongside CrowdStrike's adversary intelligence and AI-native detections.
CrowdStrike illustrates the use case with a financial services firm that receives indicators tied to a targeted phishing campaign from an industry sharing community. The team can load them into Falcon, remove duplicates, manage their lifecycle and build correlation rules to find related activity.
CrowdStrike links the feature to AI-driven SOC operations
The company argues that AI agents in the agentic SOC need threat intelligence as well as telemetry to interpret suspicious activity. Consolidating IOCs with adversary intelligence and telemetry, it says, reduces data fragmentation and lets agents correlate indicators with events and enrich investigations.
CrowdStrike offers a 15-day free trial of Falcon Next-Gen SIEM.